KitPloit - PenTest Tools!
Wholeaked - A File-Sharing Tool That Allows You To Find The Responsible Person In Case Of A Leakage

https://blogger.googleusercontent.com/img/a/AVvXsEgO-VckzRDAd2m4Q6rd5OahdeyzSx825Vv6hQwGlJrXXgl3zxcjO6oZi8UxpLKYw1shk17fNLpPSeVcdi2p2oW3bdbPggWLsBUFBx98xzmlk0W3P5EnrC4NNhqFMW9xnOcHHdBoVadseu-VbarfItxc-nL9rrytafjtVsLNOryizCsdAKtyOLQYZbcK=w640-h480 wholeaked is a file-sharing tool that allows you to find the responsible person in case of a leakage. It's written in Go. How?wholeaked gets the file that will be shared and a list of recipients. It creates a unique signature for each recipient and adds it to the file secretly. After then, it can automatically send files to the corresponding recipients by using Sendgrid, AWS SES or SMTP integrations. Instead of sending them by e-mail, you can also share them manually.

wholeaked works with every file type. However, it has additional features for common file types such as PDF, DOCX, MOV etc. Sharing Process+-----------+
|Top Secret |
|.pdf |
| |
-| |
/ | |
/ |Hidden |
a@gov / |signature1 |
/ +-----------+
/ +-----------+
+-----------++-----------+ / |Top Secret |
|Top Secret ||Recipient | / |.pdf |
|.pdf ||List | +---------+ / | |
| || | |utkusen/ | / b@gov | |
| ||a@gov |----->|wholeaked| /----------+ |
| ||b@gov | | | \ |Hidden |
| ||c@gov | +---------+ \ |signature2 |
| || | \ +-----------+
+-----------++-----------+ \ +-----------+
\ |Top Secret |
\ |.pdf |
c@gov \ | |
\ | |
\ | |
\ |Hidden |
-|signature3 |
+-----------+ Validation PartTo find who leaked the document, you just need to provide the leaked file to wholeaked, and it will reveal the responsible person by comparing the signatures in the database. +-----------+ +---------+
|Top Secret | |Signature|
|.pdf | +---------+|Database |
| | |utkusen/ || | Document leaked by
| |->|wholeaked|| |--------+
| | | || | b@gov
|Hidden | +---------+| |
|Signature2 | | |
+-----------+ +---------+ Demonstration VideoFile Types and Detection Modeswholeaked can add the unique signature to different sections of a file. Available detection modes are given below:

File Hash: SHA256 hash of the file. All file types are supported.

Binary: The signature is directly added to the binary. Almost all file types are supported.

Metadata: The signature is added to a metadata section of a file. Supported file types: PDF, DOCX, XLSX, PPTX, MOV, JPG, PNG, GIF, EPS, AI, PSD

Watermark: An invisible signature is inserted into the text. Only PDF files are supported. InstallationFrom BinaryYou can download the pre-built binaries from the releases page and run. For example: unzip wholeaked_0.1.0_macOS_amd64.zip./wholeaked --helpFrom Source1.
Install Go on your system

2.
Run: go install github.com/utkusen/wholeaked@latestInstalling Dependencieswholeaked requires exiftoolfor adding signatures to metadata section of files. If you don't want to use this feature, you don't need to install it.

1. Debian-based Linux: Run apt install exiftool2. macOS: Run brew install exiftool3. Windows: Download exiftool from here https://exiftool.org/ and put the exiftool.exein the same dir[...]

___________________________
@hacking_Attack
@Hacking_Video

ectory with wholeaked.

wholeaked requires pdftotextfor verifying watermarks inside PDF files. If you don't want to use this feature, you don't need to install it.

1. Download "Xpdf command line tools" for Linux, macOS or Windows from here: https://www.xpdfreader.com/download.html
2. Extract the archive and navigate to bin64folder.
3. Copy the pdftotext(or pdftotext.exe) executable to the same folder with wholeaked
4. For Debian Based Linux: Run apt install libfontconfigcommand. UsageBasic Usagewholeaked requires a project name -n, the path of the base file which the signatures will add -fand a list of target recipients -tExample command: ./wholeaked -n test_project -f secret.pdf -t targets.txtThe targets.txtfile should contain name and the e-mail address in the following format: Utku Sen,utku@utkusen.com
Bill Gates,bill@microsoft.com After execution is completed, the following unique files will be generated: test_project/files/Utku_Sen/secret.pdf
test_project/files/Bill_Gates/secret.pdf By default, wholeaked adds signatures to all available places that are defined in the "File Types and Detection Modes" section. If you don't want to use a method, you can define it with a falseflag. For example: ./wholeaked -n test_project -f secret.pdf -t targets.txt -binary=false -metadata=false -watermark=falseSending E-mailsIn order to send e-mails, you need to fill some sections in the CONFIGfile.

*
If you want to send e-mails via Sendgrid, type your API key to the SENDGRID_API_KEYsection.

*
If you want to send e-mails via AWS SES integration, you need to install awsclion your machine and add the required AWS key to it. wholeaked will read the key by itself. But you need to fill the AWS_REGIONsection in the config file.

*
If you want to send e-mails via a SMTP server, fill the SMTP_SERVER, SMTP_PORT, SMTP_USERNAME, SMTP_PASSWORDsections.
The other necessary fields to fill:

* EMAIL_TEMPLATE_PATHPath of the e-mail's body. You can specify use HTML or text format.
* EMAIL_CONTENT_TYPECan be htmlor text* EMAIL_SUBJECTSubject of the e-mail
* FROM_NAMEFrom name of the e-mail
* FROM_EMAILFrom e-mail of the e-mail

To specify the sending method, you can use -sendgrid, -sesor -smtpflags. For example: ./wholeaked -n test_project -f secret.pdf -t targets.txt -sendgridValidating a Leaked FileYou can use the -validateflag to reveal the owner of a leaked file. wholeaked will compare the signatures detected in the file and the database located in the project folder. Example: ./wholeaked -n test_project -f secret.pdf -validateImportant: You shouldn't delete the project_folder/db.csvfile if you want to use the file validation feature. If that file is deleted, wholeaked won't be able to compare the signatures. Download Wholeaked

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Having trouble understanding Website fundamentals, for hacking, any pointers?

I’ve been using THM and getting the hang of things, and big pictures, rather well lately. However exploiting websites is a little difficult and I don’t know what topic to study.

For example I get caught up in the “why” of certain things like how many “../“s to use to get a directory. Or how to know whether or not something is exploitable. Why I should use &ext=, what &ext= even means, why I needed to add a filter to the url, etc.

Like the dogcat room for THM is what prompted me to come here. I don’t want a handout of how to hack the room, just the name of the topic I should learn about to understand why certain exploits work for websites.

Sorry if this is all gibberish, hope someone can help, I know how to get better just don’t know where to look.

submitted by /u/OoooHeABigOlBoi
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Wordlist for password cracking

Hello, i am looking for a wordlist to perform a dictionary attack on 2 users.

am looking for a word list to crack these 2 password , can be done separatly in order to increase speed

User1 -> 8 characters long (lowercase)

User 2 -> 4 characters long (Upper case + lower case + symbols)

i am using kali linux.

submitted by /u/imaGallex
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
is this friendly challenge legal?

I am staying in a hotel with an unsecured wifi. A colleague of mine is there too but we are not on the same floor.We were joking about this unsecured network and he challenge me to get something from him across this network.

I didn't plan to get something else but am I allowed to perform some scan and more or is this forbidden?

Plus if someone have a source I can relay on about laws and restrictions to not ask the next time

Ty

​

Edit : I will not do it because of comments (thanks you mates) and also because I found something I was not supposed to found

submitted by /u/chanoir2303
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Going Passwordless? Here Are 6 Steps to Get Started

High costs and user reluctance have stood in the way of passwordless adoption, but conversion can be simplified if you take it in more gradual steps.

Dark Reading: Attacks/Breaches
Creating a Security Culture Where People Can Admit Mistakes

In cybersecurity, user error is the symptom, not the disease. A healthy culture acknowledges and addresses the underlying causes of lapses.

Dark Reading: Attacks/Breaches
10 Signs of a Good Security Leader

Strong leadership can lead to motivated and loyal employees. Here's what that looks like.

Dark Reading: Attacks/Breaches
SafeGuard Cyber Provides Security Advice for Defending Against Browser-in-the-Browser (BitB) Attacks

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Imprivata Acquires SecureLink to Deliver a Single-Vendor Platform to Manage and Secure All Enterprise and Third-Party Digital Identities

Imprivata will unlock further value for customers by unifying, integrating, and automating digital identity to enable autonomous identity systems.

___________________________
@hacking_Attack
@Hacking_Video

Euler запускает программу “баунти” ImmuneFi стоимостью $1 млн!
https://medium.com/@hush88/euler-%D0%B7%D0%B0%D0%BF%D1%83%D1%81%D0%BA%D0%B0%D0%B5%D1%82-%D0%BF%D1%80%D0%BE%D0%B3%D1%80%D0%B0%D0%BC%D0%BC%D1%83-%D0%B1%D0%B0%D1%83%D0%BD%D1%82%D0%B8-immunefi-%D1%81%D1%82%D0%BE%D0%B8%D0%BC%D0%BE%D1%81%D1%82%D1%8C%D1%8E-1-%D0%BC%D0%BB%D0%BD-187173f58583?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Программа ImmuneFi Bug Bounty направлена на укрепление безопасности Euler, одновременно развивая сотрудничество с более широкой…Continue reading on Medium » (https://medium.com/@hush88/euler-%D0%B7%D0%B0%D0%BF%D1%83%D1%81%D0%BA%D0%B0%D0%B5%D1%82-%D0%BF%D1%80%D0%BE%D0%B3%D1%80%D0%B0%D0%BC%D0%BC%D1%83-%D0%B1%D0%B0%D1%83%D0%BD%D1%82%D0%B8-immunefi-%D1%81%D1%82%D0%BE%D0%B8%D0%BC%D0%BE%D1%81%D1%82%D1%8C%D1%8E-1-%D0%BC%D0%BB%D0%BD-187173f58583?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Euler запускает программу “баунти” ImmuneFi стоимостью $1 млн!

Программа ImmuneFi Bug Bounty направлена на укрепление безопасности Euler, одновременно развивая сотрудничество с более широкой…Continue reading on Medium »
Read more...

< XSS ARMAZENADO NA SADA DE AULA VIRTUAL DA FACULDADE />

Olá meus amigos, como vocês estão? espero que estejam bem.Continue reading on Medium »
Read more...

< XSS ARMAZENADO NA SADA DE AULA VIRTUAL DA FACULDADE />
https://medium.com/@Diegoeducacao404.../xss-armazenado-na-lada-de-aula-virtual-da-faculdade-36b7e1d89b31?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Olá meus amigos, como vocês estão? espero que estejam bem.Continue reading on Medium » (https://medium.com/@Diegoeducacao404.../xss-armazenado-na-lada-de-aula-virtual-da-faculdade-36b7e1d89b31?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video